ajinabraham.njsscan.eval_node.eval_nodejs

Author
1,129
Download Count*
License
User controlled data in eval() or similar functions may result in Server Side Injection or Remote Code Injection
Run Locally
Run in CI
Defintion
rules:
- id: eval_nodejs
patterns:
- pattern-either:
- pattern-inside: function ($REQ, $RES, ...) {...}
- pattern-inside: function $FUNC($REQ, $RES, ...) {...}
- pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
- pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
- pattern-either:
- pattern: |
new Function(..., <... $REQ.$QUERY.$VAR ...>, ...)
- pattern: |
new Function(..., <... $REQ.$QUERY ...>, ...)
- pattern: |
eval(..., <... $REQ.$QUERY.$VAR ...>, ...)
- pattern: |
eval(..., <... $REQ.$QUERY ...>, ...)
- pattern: |
setTimeout(..., <... $REQ.$QUERY.$VAR ...>, ...)
- pattern: |
setTimeout(..., <... $REQ.$QUERY ...>, ...)
- pattern: |
setInterval(..., <... $REQ.$QUERY.$VAR ...>, ...)
- pattern: |
setInterval(..., <... $REQ.$QUERY ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY.$VAR ...>;
...
new Function(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY ...>;
...
new Function(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY.$VAR ...>;
...
eval(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY ...>;
...
eval(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY.$VAR ...>;
...
setTimeout(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY ...>;
...
setTimeout(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY.$VAR ...>;
...
setInterval(..., <... $INP ...>, ...)
- pattern: |
$INP = <... $REQ.$QUERY ...>;
...
setInterval(..., <... $INP ...>, ...)
message: User controlled data in eval() or similar functions may result in
Server Side Injection or Remote Code Injection
languages:
- javascript
severity: ERROR
metadata:
owasp-web: a1
cwe: cwe-95
license: LGPL-3.0-or-later
Short Link: https://sg.run/3x6D